Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
17/05/2023, 16:52
General
-
Target
freemind.exe
-
Size
61.9MB
-
MD5
83cd813c584aba7272bf221da9014e19
-
SHA1
c952a9f91587fa661a9e66741a472d7bb70c192f
-
SHA256
785565ac4cf379c857f97890070e7f82afdf72f9e65e1a71902732af0fc00110
-
SHA512
3110d0ab355904a0d84982010687fb2d201611c19a6399edd90327cee09fda9eb322c280446fb750ca033c5ab9fc5ce1b589438fdb31774f4ef9c3d1507058ad
-
SSDEEP
1572864:4qeNFSP4gwKIqr6bWNv1NNdhh5j28K51BlNQHypmj3n:4/FUHyWd1NHhh128KxlgyY3n
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\freemind.exe"C:\Users\Admin\AppData\Local\Temp\freemind.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CPD1H.tmp\freemind.tmp"C:\Users\Admin\AppData\Local\Temp\is-CPD1H.tmp\freemind.tmp" /SL5="$70126,64625855,56832,C:\Users\Admin\AppData\Local\Temp\freemind.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
690KB
MD5a2c4d52c66b4b399facadb8cc8386745
SHA1c326304c56a52a3e5bfbdce2fef54604a0c653e0
SHA2566c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a
SHA5122a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6
-
Filesize
5KB
MD5d1901cbcb582ceac857c8745255faa6f
SHA1f937b62d2fdd652dba75dda3efcfce780f87230e
SHA2569718fa28ddd30f7c81065e9855495c4a3b3082135f4be2bc1de6547feec46a5c
SHA512efb0066a8b02c2ed9b3127e3bf99eb696f696fc13e00545ff8ac47782353ed9f8a62c3e77d9061428ba6efd0b55ef8f7be59636d20d013289ff152f11cff4dbe
-
Filesize
5KB
MD55630578c8236148833c12a58c14530d4
SHA1a6478f98bf73f7cc18f151c98cc18885321c9bc4
SHA256138e1d09eb36704e82565317c9b7b616910368c1634733bb4899dfffe6efbffe
SHA5128cea49d492f8d7ddaf8e9df40b75b03ab8397fd70aa51074c35e2f0a373ceb2b3f87110a10bf51fe08ab190e9ab8ee4b4049359682df8c6647b2999c0e62f5ff
-
Filesize
690KB
MD5a2c4d52c66b4b399facadb8cc8386745
SHA1c326304c56a52a3e5bfbdce2fef54604a0c653e0
SHA2566c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a
SHA5122a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
11KB
MD53133066770f4cbabc512bb73ca6c39ff
SHA15ea2a744442c521c72c2c9de7513cd05b961e591
SHA2568acfa833388f02a698896ca8c581d098c9ea71d5d38b3d40757e1693788f1565
SHA5127bcf1d56301b4f40ac10ba74f80c1cb21b6e95ef382c1310e4b2086da709eb62a3eb870c05a44990d75015f4fcfda4873442e1e42d0083f9bda2f7939e612234
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
